CVE-2024-28147 - Unrestricted Upload of Files in edu-sharing

Back Back to CVE browser

HIGH

Unrestricted Upload of Files in edu-sharing

Published Jun 20, 2024

7.4

HIGH

CVSS 3.1

EPSS 0.83%

Description

An authenticated user can upload arbitrary files in the upload function for collection preview images. An attacker may upload an HTML file that includes malicious JavaScript code which will be executed if a user visits the direct URL of the collection preview image (Stored Cross Site Scripting). It is also possible to upload SVG files that include nested XML entities. Those are parsed when a user visits the direct URL of the collection preview image, which may be utilized for a Denial of Service attack.

This issue affects edu-sharing: <8.0.8-RC2, <8.1.4-RC0, <9.0.0-RC19.

Affected products

Vendor metaVentis GmbH Product Edu-Sharing Default
affected
- Version
  <8.0.8-RC2, <8.1.4-RC0, <9.0.0-RC19
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

metaVentis GmbH

Edu-Sharing

affected

Version	Status	Constraints
<8.0.8-RC2, <8.1.4-RC0, <9.0.0-RC19	affected	-

Vendor Metaventis Product Edu-Sharing Default
n/a
- Version
  0
  Status
  affected
  Constraints
  <8.0.8-rc2
- Version
  0
  Status
  affected
  Constraints
  <8.1.4-rc0
- Version
  0
  Status
  affected
  Constraints
  <9.0.0-rc19

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Metaventis

Edu-Sharing

n/a

Version	Status	Constraints
0	affected	<8.0.8-rc2
0	affected	<8.1.4-rc0
0	affected	<9.0.0-rc19

Remediation

Vendor solution

The repository base version in use can be identified in the Admin-Tools. The vendor provides a patch for the affected versions:

* Version 8.0: Update repository version to "8.0.8-RC2" or later * Version 8.1: Update repository version to "8.1.4-RC0" or later * Version 9.0: Update repository version to "9.0.0-RC19" or later

Weaknesses (1)

CWE-434

Unrestricted Upload of File

References (4)

http://seclists.org/fulldisclosure/2024/Jun/11
https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-25294
Advisory
https://packetstormsecurity.com/files/179199
https://r.sec-consult.com/metaventis
third-party-advisory

Link	Providers	Tags
http://seclists.org/fulldisclosure/2024/Jun/11
https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-25294		Advisory
https://packetstormsecurity.com/files/179199
https://r.sec-consult.com/metaventis		third-party-advisory